Splunk Search

How to add "LIKE" instead of "=" and add wildcard to search?

amandaxtru
Engager
 <title>Routers</title>

| dbquery "routerdb" "SELECT DEVICE_LOC FROM routerdb.LKP_LOCATION_EDITED WHERE METRO_CITY LIKE '%Philadelphia%'"

| stats count by DEVICE_LOC
| fields - count
| rename DEVICE_LOC AS ROUTER

| format

Outputs: ( ( ROUTER="PHIL" ) OR ( ROUTER="PHL02" ) OR ( ROUTER="PHL23" ) OR ( ROUTER="PHL24" ) OR ( ROUTER="PHL6" ) OR ( ROUTER="PHL8" ) OR ( ROUTER="PHLAPA" ) )

How would I make it so it would be like (ROUTER LIKE "PHIL%") with the "%" wildcard? I'm trying to use these router prefixes to find all routers with that prefix. Thanks in advance!

0 Karma

sundareshr
Legend

Like this

| dbquery "routerdb" "SELECT DEVICE_LOC FROM routerdb.LKP_LOCATION_EDITED WHERE METRO_CITY LIKE '%Philadelphia%'" 
| stats count by DEVICE_LOC
| fields - count 
| eval ROUTER=DEVICE_LOC."%"
| fields ROUTER
| format
| eval search=replace(search, "=", " LIKE ")
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...